Intrusion and anomaly detection model exchange for mobile ad-hoc networks


Mobile Ad-hoc NETworks (MANETs) pose unique security requirements and challenges due to their reliance on open, peer-to-peer models that often don’t require authentication between nodes. Additionally, the limited processing power and battery life of the devices used in a MANET also prevent the adoption of heavy-duty cryptographic techniques. While traditional misuse-based Intrusion Detection Systems (IDSes) may work in a MANET, watching for packet dropouts or unknown outsiders is difficult as both occur frequently in both malicious and non-malicious traffic. Anomaly detection approaches hold out more promise, as they utilize learning techniques to adapt to the wireless environment and flag malicious data. The anomaly detection model can also create device behavior profiles, which peers can utilize to help determine its trustworthiness. However, computing the anomaly model itself is a time-consuming and processor-heavy task. To avoid this, we propose the use of model exchange as a device moves between different networks as a means to minimize computation and traffic utilization. Any node should be able to obtain peers’ model(s) and evaluate it against its own model of “normal” behavior. We present this model, discuss scenarios in which it may be used, and provide preliminary results and a framework for future implementation. Keywords-mobile ad-hoc networks; intrusion detection; anomaly detection; model exchange; profiling; model aggregation

Extracted Key Phrases

6 Figures and Tables

Cite this paper

@article{Cretu2006IntrusionAA, title={Intrusion and anomaly detection model exchange for mobile ad-hoc networks}, author={G . Cretu and J. J. Parekh and Ke Wang and S. J. Stolfo}, journal={CCNC 2006. 2006 3rd IEEE Consumer Communications and Networking Conference, 2006.}, year={2006}, volume={1}, pages={635-639} }